MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42e71a6e0d1db101fe1fb3f5d8f067aea2fda52b24050dbadea6d8ebdddc4a81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 10


Intelligence 10 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42e71a6e0d1db101fe1fb3f5d8f067aea2fda52b24050dbadea6d8ebdddc4a81
SHA3-384 hash: b6cb93966d885cf4443a1b8cc1cf08df7e577ba46686680c90d425217d91ca47d9663642a2eadeb4732b08819f5bfb89
SHA1 hash: 679b38b7805a31693fe0cbcd26b63bfcb9916def
MD5 hash: f5b1e06d48a47faa5dc9df2436864f9a
humanhash: kilo-fish-five-maine
File name:232.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:513'407 bytes
First seen:2021-06-22 06:29:03 UTC
Last seen:2021-06-22 07:51:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:1BlL/3l07aPz16tGqAH8OlOpQkj+t3LfEg4GM9C2pAOk5DVcry5UWtkNPLlrPDKX:jBSWzYtSNOpQU+tbcB8OGiryCLNPLB2
Threatray 259 similar samples on MalwareBazaar
TLSH F1B40237163C9457DD3B3CF2655299CEA8F46803292998777BA12F3F806C683D50EA4B
Reporter lowmal3
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
232.exe
Verdict:
Malicious activity
Analysis date:
2021-06-22 06:32:59 UTC
Tags:
evasion trojan
Link:
https://app.any.run/tasks/1e9c0134-bee8-4e00-a7ca-37af25358e42

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167449/
Detection(s):
SecuriteInfo.com.Trojan.Loader.844.28831.28749.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/28cf9104-f593-49cd-bab4-675ddeaf2dbb
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/805779
Signature
.NET source code references suspicious native API functions
Contains functionality to capture screen (.Net source)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 438191 Sample: 232.exe Startdate: 22/06/2021 Architecture: WINDOWS Score: 100 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 4 other signatures 2->52 6 dtkjg.exe 17 2->6         started        10 dtkjg.exe 17 2->10         started        12 232.exe 1 21 2->12         started        process3 file4 22 C:\Users\user\AppData\Local\Temp\qejmpi, DOS 6->22 dropped 24 C:\Users\user\AppData\Local\...\System.dll, PE32 6->24 dropped 54 Writes to foreign memory regions 6->54 56 Maps a DLL or memory area into another process 6->56 14 MSBuild.exe 4 6->14         started        26 C:\Users\user\AppData\Local\...\System.dll, PE32 10->26 dropped 58 Multi AV Scanner detection for dropped file 10->58 60 Machine Learning detection for dropped file 10->60 18 MSBuild.exe 4 10->18         started        28 C:\Users\user\AppData\Roaming\...\dtkjg.exe, PE32 12->28 dropped 30 C:\Users\user\AppData\Local\...\System.dll, PE32 12->30 dropped 20 MSBuild.exe 15 4 12->20         started        signatures5 process6 dnsIp7 32 checkip.dyndns.org 14->32 62 Tries to steal Mail credentials (via file access) 14->62 64 Tries to harvest and steal ftp login credentials 14->64 66 Tries to harvest and steal browser information (history, passwords, etc) 14->66 34 checkip.dyndns.org 18->34 36 216.146.43.71, 49743, 49744, 49748 DYNDNSUS United States 18->36 44 2 other IPs or domains 18->44 38 checkip.dyndns.org 20->38 40 checkip.dyndns.com 131.186.161.70, 49733, 49735, 80 DYNDNSUS United States 20->40 42 freegeoip.app 172.67.188.154, 443, 49736, 49750 CLOUDFLARENETUS United States 20->42 68 May check the online IP address of the machine 20->68 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42e71a6e0d1db101fe1fb3f5d8f067aea2fda52b24050dbadea6d8ebdddc4a81/
Threat name:
Win32.Trojan.Nemesis
Create hunting rule
Status:
Malicious
First seen:
2021-06-21 01:12:17 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iltru3qndwyqd7q7wp25r4dhv2rp3jjleqcq3ow6u3moxxo4jkaq._file
Verdict:
malicious
Similar samples:
022e918d8b07b6bda3fc703e212db5d145fa5814f33ea2fa8a350e2be405a348
SnakeKeylogger
19114d1f7709bcabb6ea19c9145267e114a403a690975c6eac5c8478ed278cf2
SnakeKeylogger
57bcdee4cc181db0c6671ccdd70a978bc4fa752bd6bfc9557be713539127baee
SnakeKeylogger
7320b115d96ae0e50fe44d8600bd0bd68e2fac3bb4604f8f333f04e247c301bd
SnakeKeylogger
93cae28d3ae17b560c738e38d6ff788924bb515c1312d39f5122041dcc79a114
SnakeKeylogger
ab74bc0055021acfabe6b05c55f5dd39ba805c770825ca887c1ac6c135f4bd99
SnakeKeylogger
bdbba0c991f70ccddad27da903e5e689a6e762ac23ab78ffea10f389f55045c3
SnakeKeylogger
c751f9d546d20216bdc996ecdcea6ee9f57771682879383621bff83a8229e384
SnakeKeylogger
d09500f30f90dcdf6caac545bff9663876dc3a7de445d618e947ba64a5f4966b
SnakeKeylogger
e8bc94b0faea9886f1fa39e0e9f609f2f266b3d7d812faad4b2ae9904b170b00
SnakeKeylogger
+ 249 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/210622-j76g7241xs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Unpacked files
SH256 hash:
049a3787d59652f29e40d7882abac625fded66dd5a20f61060e6910515a019f7
MD5 hash:
dbb8c873ebb0a95e9f7c83b5d68d6579
SHA1 hash:
ffd776a2b0cd82835f437a41602cd403823140db
Link:
https://www.unpac.me/results/6bc17657-aa14-4caf-93aa-0ce29190939d/
Parent samples :
932694b1d0a75e54084e271e67c1bf8fd87aa889bf5d8137bb16cfa6f87b4f14
6379623552f5d0965d8cfe83f3725942907a9b26766e3e6cb5e27258b1e120d9
SH256 hash:
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 hash:
56a321bd011112ec5d8a32b2f6fd3231
SHA1 hash:
df20e3a35a1636de64df5290ae5e4e7572447f78
Link:
https://www.unpac.me/results/6bc17657-aa14-4caf-93aa-0ce29190939d/
SH256 hash:
42e71a6e0d1db101fe1fb3f5d8f067aea2fda52b24050dbadea6d8ebdddc4a81
MD5 hash:
f5b1e06d48a47faa5dc9df2436864f9a
SHA1 hash:
679b38b7805a31693fe0cbcd26b63bfcb9916def
Link:
https://www.unpac.me/results/6bc17657-aa14-4caf-93aa-0ce29190939d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/42e71a6e0d1db101fe1fb3f5d8f067aea2fda52b24050dbadea6d8ebdddc4a81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Choice_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:pe_imphash
Create hunting rule
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_bot_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

Executable exe 42e71a6e0d1db101fe1fb3f5d8f067aea2fda52b24050dbadea6d8ebdddc4a81

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/167449/

Comments